In which scenario would you not select a resource forest for Azure AD synchronization?

• A. When users need to be synchronized from on-premises AD
• B. When leveraging existing Azure AD users
• C. When requiring guest user access across forests
• D. When needing to sync extensive user attributes

Answer: (A)

A resource forest is typically utilized in scenarios where there is a need to manage resources in a separate forest from the user accounts, particularly in complex environments with multiple forests and varying user requirements.

When users need to be synchronized from on-premises Active Directory (AD), a resource forest model may not be the best choice. This is because the resource forest primarily serves as a place to store resources like applications and services, while the user accounts are usually maintained in a separate user forest. If the goal is to directly synchronize users from an on-premises AD into Azure AD, utilizing a user or single forest is more straightforward and effective.

In scenarios such as leveraging existing Azure AD users or requiring guest user access across forests, a resource forest can provide certain benefits. For example, existing Azure AD users can be easily accessed without complicating the structure. Guest user access also does not necessitate a resource forest because it can be managed without complicating the synchronization process.

Similarly, syncing extensive user attributes benefits from a user forest setup where user identities are maintained and synchronized more efficiently. This focus on users in a dedicated user forest allows for broader and more effective use of attributes, which might be limited in a resource forest scenario due to its function primarily for resources